diff --git a/project-lakitu/sys-boot/shim/Manifest b/project-lakitu/sys-boot/shim/Manifest
index 131eb9f..c788153 100644
--- a/project-lakitu/sys-boot/shim/Manifest
+++ b/project-lakitu/sys-boot/shim/Manifest
@@ -1 +1 @@
-DIST shim-15.tar.bz2 1027215 BLAKE2B 425055998fd7af4751615241a69934b023581716eeb76d01e074e159b12bf414079d450ff6c574e0c398b259563149fe8a83a43f4c5496bbfb6c3550fdb7e4b6 SHA512 f7dfac774d644111431ca56da76b5575b891b0abad970b318edaede11a0d83c869728bc39cb6af3689bdb203c6826545caf8ddd3d14228831027e334963cf957
+DIST shim-15.4.tar.bz2 1260475 BLAKE2B b3a3c43df62ccc833fc2ffcae7d913d236b18469f73fd4abcf6a64b904c3cde445592562cac387f8d960184758bcfeb7fa4b0f088caa6402e2e56fc5a460faf9 SHA512 b9712fe6964f60de251f1bff83914c4aac0f6430474c44741c059f31b72c2d5987c313cbb5e8bc07bfd04e61e6b511ea2d19a9975cde8c6127bc05f2de834526
diff --git a/project-lakitu/sys-boot/shim/files/shim-15-built-in-platform-key.patch b/project-lakitu/sys-boot/shim/files/shim-15-built-in-platform-key.patch
deleted file mode 100644
index d371bcf..0000000
--- a/project-lakitu/sys-boot/shim/files/shim-15-built-in-platform-key.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-diff --git a/mok.c b/mok.c
-index 3867521..2b081f5 100644
---- a/mok.c
-+++ b/mok.c
-@@ -79,6 +79,7 @@ struct mok_state_variable {
- #define MOK_MIRROR_DELETE_FIRST	0x02
- #define MOK_VARIABLE_MEASURE	0x04
- #define MOK_VARIABLE_LOG	0x08
-+#define MOK_USE_BUILTIN		0x10
- 
- struct mok_state_variable mok_state_variables[] = {
- 	{.name = L"MokList",
-@@ -91,7 +92,8 @@ struct mok_state_variable mok_state_variables[] = {
- 	 .addend_source = &vendor_cert,
- 	 .addend_size = &vendor_cert_size,
- 	 .flags = MOK_MIRROR_KEYDB |
--		  MOK_VARIABLE_LOG,
-+		  MOK_VARIABLE_LOG |
-+		  MOK_USE_BUILTIN,
- 	 .pcr = 14,
- 	},
- 	{.name = L"MokListX",
-@@ -130,6 +132,63 @@ struct mok_state_variable mok_state_variables[] = {
- 	{ NULL, }
- };
- 
-+
-+static EFI_STATUS builtin_one_mok_variable(struct mok_state_variable *v)
-+{
-+	EFI_STATUS efi_status = EFI_SUCCESS;
-+	void *FullData = NULL;
-+	UINTN FullDataSize = 0;
-+	uint8_t *p = NULL;
-+
-+	if ((v->flags & MOK_MIRROR_KEYDB) &&
-+	    v->addend_source && *v->addend_source &&
-+	    v->addend_size && *v->addend_size) {
-+		EFI_SIGNATURE_LIST *CertList = NULL;
-+		EFI_SIGNATURE_DATA *CertData = NULL;
-+		FullDataSize = sizeof (*CertList)
-+			     + sizeof (EFI_GUID)
-+			     + *v->addend_size;
-+		FullData = AllocatePool(FullDataSize);
-+		if (!FullData) {
-+			perror(L"Failed to allocate space for MokListRT\n");
-+			return EFI_OUT_OF_RESOURCES;
-+		}
-+		p = FullData;
-+
-+		CertList = (EFI_SIGNATURE_LIST *)p;
-+		p += sizeof (*CertList);
-+		CertData = (EFI_SIGNATURE_DATA *)p;
-+		p += sizeof (EFI_GUID);
-+
-+		CertList->SignatureType = EFI_CERT_TYPE_X509_GUID;
-+		CertList->SignatureListSize = *v->addend_size
-+					      + sizeof (*CertList)
-+					      + sizeof (*CertData)
-+					      -1;
-+		CertList->SignatureHeaderSize = 0;
-+		CertList->SignatureSize = *v->addend_size + sizeof (EFI_GUID);
-+
-+		CertData->SignatureOwner = SHIM_LOCK_GUID;
-+		CopyMem(p, *v->addend_source, *v->addend_size);
-+	} else if (v->state) {
-+		FullDataSize = sizeof (UINT8);
-+		FullData = v->state;
-+	}
-+
-+	if (FullDataSize) {
-+		efi_status = gRT->SetVariable(v->rtname, v->guid,
-+					      EFI_VARIABLE_BOOTSERVICE_ACCESS |
-+					      EFI_VARIABLE_RUNTIME_ACCESS,
-+					      FullDataSize, FullData);
-+		if (EFI_ERROR(efi_status)) {
-+			perror(L"Failed to set %s: %r\n",
-+			       v->rtname, efi_status);
-+		}
-+	}
-+
-+	return efi_status;
-+}
-+
- static EFI_STATUS mirror_one_mok_variable(struct mok_state_variable *v)
- {
- 	EFI_STATUS efi_status = EFI_SUCCESS;
-@@ -226,8 +285,16 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
- 		efi_status = get_variable_attr(v->name,
- 					       &v->data, &v->data_size,
- 					       *v->guid, &attrs);
--		if (efi_status == EFI_NOT_FOUND)
-+		if (efi_status == EFI_NOT_FOUND) {
-+			if (v->flags & MOK_USE_BUILTIN) {
-+				efi_status = builtin_one_mok_variable(v);
-+				if (EFI_ERROR(efi_status) &&
-+				    ret != EFI_SECURITY_VIOLATION)
-+					ret = efi_status;
-+			}
- 			continue;
-+		}
-+
- 		if (EFI_ERROR(efi_status)) {
- 			perror(L"Could not verify %s: %r\n", v->name,
- 			       efi_status);
diff --git a/project-lakitu/sys-boot/shim/files/shim-15-fix-aarch64-build.patch b/project-lakitu/sys-boot/shim/files/shim-15-fix-aarch64-build.patch
deleted file mode 100644
index 88d7c1e..0000000
--- a/project-lakitu/sys-boot/shim/files/shim-15-fix-aarch64-build.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/Make.defaults b/Make.defaults
-index e11ab5a..ac2a25b 100644
---- a/Make.defaults
-+++ b/Make.defaults
-@@ -89,7 +89,7 @@ ifeq ($(ARCH),aarch64)
- 	ARCH_SUFFIX_UPPER	?= AA64
- 	FORMAT			:= -O binary
- 	SUBSYSTEM		:= 0xa
--	ARCH_LDFLAGS		+= --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
-+	override ARCH_LDFLAGS		+= --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
- endif
- ifeq ($(ARCH),arm)
- 	CFLAGS += -DMDE_CPU_ARM -DPAGE_SIZE=4096 -mstrict-align
-@@ -98,7 +98,7 @@ ifeq ($(ARCH),arm)
- 	ARCH_SUFFIX_UPPER	?= ARM
- 	FORMAT			:= -O binary
- 	SUBSYSTEM		:= 0xa
--	ARCH_LDFLAGS		+= --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
-+	override ARCH_LDFLAGS		+= --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
- endif
- 
- FORMAT		?= --target efi-app-$(ARCH)
diff --git a/project-lakitu/sys-boot/shim/files/shim-15-fix-vlogerror-arm64-crash.patch b/project-lakitu/sys-boot/shim/files/shim-15-fix-vlogerror-arm64-crash.patch
deleted file mode 100644
index 0e78d88..0000000
--- a/project-lakitu/sys-boot/shim/files/shim-15-fix-vlogerror-arm64-crash.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 344a8364cb05cdaafc43231d0f73d5217c4e118c Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Tue, 12 Feb 2019 18:04:49 -0500
-Subject: [PATCH] VLogError(): Avoid NULL pointer dereferences in (V)Sprint
- calls
-
-VLogError() calculates the size of format strings by using calls to
-SPrint and VSPrint with a StrSize of 0 and NULL for an output buffer.
-Unfortunately, this is an incorrect usage of (V)Sprint. A StrSize
-of "0" is special-cased to mean "there is no limit". So, we end up
-writing our string to address 0x0. This was discovered because it
-causes a crash on ARM where, unlike x86, it does not necessarily
-have memory mapped at 0x0.
-
-Avoid the (V)Sprint calls altogether by using (V)PoolPrint, which
-handles the size calculation and allocation for us.
-
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Fixes: 25f6fd08cd26 ("try to show errors more usefully.")
-[dannf: commit message ]
-Signed-off-by: dann frazier <dann.frazier@canonical.com>
-Upstream-commit-id: 20e731f423a
----
- errlog.c | 15 +++------------
- 1 file changed, 3 insertions(+), 12 deletions(-)
-
-diff --git a/errlog.c b/errlog.c
-index 18be4822..eebb266d 100644
---- a/errlog.c
-+++ b/errlog.c
-@@ -14,29 +14,20 @@ EFI_STATUS
- VLogError(const char *file, int line, const char *func, CHAR16 *fmt, va_list args)
- {
- 	va_list args2;
--	UINTN size = 0, size2;
- 	CHAR16 **newerrs;
- 
--	size = SPrint(NULL, 0, L"%a:%d %a() ", file, line, func);
--	va_copy(args2, args);
--	size2 = VSPrint(NULL, 0, fmt, args2);
--	va_end(args2);
--
- 	newerrs = ReallocatePool(errs, (nerrs + 1) * sizeof(*errs),
- 				       (nerrs + 3) * sizeof(*errs));
- 	if (!newerrs)
- 		return EFI_OUT_OF_RESOURCES;
- 
--	newerrs[nerrs] = AllocatePool(size*2+2);
-+	newerrs[nerrs] = PoolPrint(L"%a:%d %a() ", file, line, func);
- 	if (!newerrs[nerrs])
- 		return EFI_OUT_OF_RESOURCES;
--	newerrs[nerrs+1] = AllocatePool(size2*2+2);
-+	va_copy(args2, args);
-+	newerrs[nerrs+1] = VPoolPrint(fmt, args2);
- 	if (!newerrs[nerrs+1])
- 		return EFI_OUT_OF_RESOURCES;
--
--	SPrint(newerrs[nerrs], size*2+2, L"%a:%d %a() ", file, line, func);
--	va_copy(args2, args);
--	VSPrint(newerrs[nerrs+1], size2*2+2, fmt, args2);
- 	va_end(args2);
- 
- 	nerrs += 2;
diff --git a/project-lakitu/sys-boot/shim/files/shim-15.4-fix-gcc-host-leak.patch b/project-lakitu/sys-boot/shim/files/shim-15.4-fix-gcc-host-leak.patch
new file mode 100644
index 0000000..7655c9f
--- /dev/null
+++ b/project-lakitu/sys-boot/shim/files/shim-15.4-fix-gcc-host-leak.patch
@@ -0,0 +1,11 @@
+--- a/gnu-efi/Make.defaults	2021-04-09 17:35:17.978394775 +0000
++++ b/gnu-efi/Make.defaults	2021-04-09 17:35:25.311076592 +0000
+@@ -67,7 +67,7 @@
+ # Compilation tools
+ COMPILER     ?= gcc
+ ARCHIVER     ?= gcc-ar
+-HOSTCC       := $(COMPILER)
++HOSTCC       := $(BUILD_CC)
+ CC           := $(CROSS_COMPILE)$(COMPILER)
+ AS           := $(CROSS_COMPILE)as
+ LD           := $(CROSS_COMPILE)ld
diff --git a/project-lakitu/sys-boot/shim/files/shim-15.4-force-ld.bfd.patch b/project-lakitu/sys-boot/shim/files/shim-15.4-force-ld.bfd.patch
new file mode 100644
index 0000000..a7f4aa3
--- /dev/null
+++ b/project-lakitu/sys-boot/shim/files/shim-15.4-force-ld.bfd.patch
@@ -0,0 +1,13 @@
+diff --git a/Make.defaults b/Make.defaults
+index a775083e..d569476f 100644
+--- a/Make.defaults
++++ b/Make.defaults
+@@ -6,7 +6,7 @@
+ COMPILER	?= gcc
+ CC		= $(CROSS_COMPILE)$(COMPILER)
+ HOSTCC		= $(COMPILER)
+-LD		= $(CROSS_COMPILE)ld
++LD		= $(CROSS_COMPILE)ld.bfd
+ OBJCOPY		= $(CROSS_COMPILE)objcopy
+ DOS2UNIX	?= dos2unix
+ D2UFLAGS	?= -r -l -F -f -n
diff --git a/project-lakitu/sys-boot/shim/shim-15-r3.ebuild b/project-lakitu/sys-boot/shim/shim-15-r3.ebuild
deleted file mode 120000
index aa8fc90..0000000
--- a/project-lakitu/sys-boot/shim/shim-15-r3.ebuild
+++ /dev/null
@@ -1 +0,0 @@
-shim-15.ebuild
\ No newline at end of file
diff --git a/project-lakitu/sys-boot/shim/shim-15.4-r1.ebuild b/project-lakitu/sys-boot/shim/shim-15.4-r1.ebuild
new file mode 120000
index 0000000..f3ba15b
--- /dev/null
+++ b/project-lakitu/sys-boot/shim/shim-15.4-r1.ebuild
@@ -0,0 +1 @@
+shim-15.4.ebuild
\ No newline at end of file
diff --git a/project-lakitu/sys-boot/shim/shim-15.ebuild b/project-lakitu/sys-boot/shim/shim-15.4.ebuild
similarity index 75%
rename from project-lakitu/sys-boot/shim/shim-15.ebuild
rename to project-lakitu/sys-boot/shim/shim-15.4.ebuild
index 133959a..c62dd81 100644
--- a/project-lakitu/sys-boot/shim/shim-15.ebuild
+++ b/project-lakitu/sys-boot/shim/shim-15.4.ebuild
@@ -17,13 +17,10 @@
 
 RDEPEND=""
 DEPEND="dev-libs/openssl
-	sys-boot/gnu-efi
 	platform-key? ( sys-boot/platform-key )
 	"
 IUSE="platform-key"
 
-S="${WORKDIR}/${P}"
-
 shim_arch() {
 	case ${ARCH} in
 	amd64) echo "x86_64";;
@@ -41,28 +38,21 @@
 }
 
 src_prepare() {
-	cros_use_gcc
-	epatch "${FILESDIR}"/${PN}-15-fix-aarch64-build.patch
-	epatch "${FILESDIR}"/${PN}-15-fix-vlogerror-arm64-crash.patch
-	epatch "${FILESDIR}"/${PN}-15-built-in-platform-key.patch
+	epatch "${FILESDIR}"/${P}-fix-gcc-host-leak.patch
+	epatch "${FILESDIR}"/${P}-force-ld.bfd.patch
 	default
 }
 
 src_compile() {
 	local extra_opts=()
 
-	if tc-ld-is-gold; then
-		extra_opts+=( ARCH_LDFLAGS="--no-experimental-use-relr" )
-	fi
-
 	if use platform-key; then
 		extra_opts+=( VENDOR_CERT_FILE="${ROOT}/build/share/platform-key/signing_key.cer" )
 	fi
 
 	emake ARCH="$(shim_arch)" \
 		CROSS_COMPILE="${CHOST}-" \
-		EFI_INCLUDE="${ROOT}/usr/include/efi" \
-		EFI_PATH="${ROOT}/usr/$(get_libdir)" \
+		COMMITID="${GIT_COMMIT_ID}" \
 		DEFAULT_LOADER="\\\\\\\\grub-lakitu.efi" \
 		"${extra_opts[@]}" \
 		$(shim_binary)